Reverse Engineering Quadcopter Protocols

Necessity is the mother of invention, but cheap crap from China is the mother of reverse engineering. [Michael] found a very, very cheap toy quadcopter in his local shop, and issued a challenge to himself. He would reverse engineer this quadcopter’s radio protocol. His four-post series of exploits covers finding the right frequency for the radio, figuring out the protocol, and building his own remote for this cheap toy.

[Michael] was already familiar with the capabilities of these cheap toys after reading a Hackaday post, and the 75-page, four language manual cleared a few things up for him. The ‘Quadro-Copter’ operated on 2.4GHz, but did not give any further information. [Michael] didn’t know what channel the toy was receiving on, what data rate, or what the header for the transmission was. SDR would be a good tool for figuring this out, but thanks to Travis Goodspeed, there’s a really neat trick that will put a 2.4GHz nRF24L01+ radio into promiscuous mode, allowing [Michael] to read the transmissions between the transmitter and quadcopter. This code is available on [Michael]’s github.

A needle in an electromagnetic haystack was found and [Michael] could listen in on the quadcopter commands. The next step was interpreting the ones and zeros, and with the help of a small breakout board and soldering directly to the SPI bus on the transmitter, [Michael] was able to do just that. By going through the nRF24 documentation, he was able to suss out the pairing protocol and read the stream of bytes that commanded the quadcopter.

What [Michael] was left with is a series of eight bytes sent in a continuous stream from the transmitter to the toy. These bytes contained the throttle, yaw, pitch, roll, and a ‘flip’ settings, along with three bytes of ‘counters’ that didn’t seem to do anything.  With that info in hand, [Michael] took an Arduino Nano, an nRF04L01+ transceiver, and a Wii nunchuck to build his own transmitter. If you’re looking for a ‘how to reverse engineer’ guide, it generally doesn’t get better than this.

You can check out a video of [Michael] flying his Wiimoted quadcopter below.

Continue reading “Reverse Engineering Quadcopter Protocols”

Beest of an RC Toy

Sometimes hackers and makers hack and make stuff just because they can. Why spend hours in a CAD program designing a gazillion gears, brackets and struts? Why cut them all out on a homemade CNC? Why use a PIC and perf board to control everything? Because we can. Well, because [Est] can, rather. He put together this RC controlled beast of a toy with multiple legs and crushing claws.

It’s made out of 6 mm acrylic and threaded rod. The legs are controlled by two DC motors, while the mouth uses two geared steppers. The beast talks to the controller via a pair of 433 MHz transceivers using a protocol similar to how an IR remote talks to a television. A handful of LEDs lights up the clear acrylic, making it look extra scary.

This design is, of course, based on the Strandbeest concept from [Theo Jansen]. It’s a great robotics project because your project doesn’t suffer under its own weight. It’s more like a tracked machine. In fact, we saw a huge rideable version made of metal at BAMF this year. That’s one you just can’t miss!

Continue reading “Beest of an RC Toy”

Reverse Engineering An RC Spy Tank

[Michael] sells a remote control spy tank through his company, and although it’s a toy, there’s an impressive amount of electronics in this R/C tank. It’s controlled from an Android or iDevice over a WiFi connection, something that simply won’t do if you’re trying to sell this to the hacker and maker crowd. The solution to this problem is Wireshark, and with a little bit of work this spy tank can be controlled from just about anything, from a microcontroller via WiFi to a Python app.

Wireshark, everyone’s favorite network packet analysis and capture tool, was used to listen in on the communications between an iPad and the tank. This immediately showed the video stream coming from the camera in the tank, and pointing VLC to the correct port displayed the video.

The motors in the tank were a little trickier, but looking at the data stream, a few packets stood out as being responsible for controlling the motors. After a little experimentation the simple command set was decoded and a Python app whipped up.

These spy tanks are cheap – about $70 from [Michael]’s company and the other usual vendors. It’s not a particularly useful piece of hardware, but someone out there is sure to do something cool with this bit of reverse engineering.

14 Wheel Drive Vehicle Climbs Over Most Things

What do you get when you cross 7 hobby gearboxes with 14 wheels and a LiPo battery? Instead of speculating an answer, we can just check out one of [rctestflight’s] projects.

He came across those hobby gearboxes and thought it would be fun to build a 14 wheel drive contraption. Each gearbox has its own motor and is wrapped up in a nice tidy package also including the axle and wheels. All of the wheels mounted on a straight board wouldn’t be much fun so [rctestflight] used heavy duty zip ties that act as a flexible frame to connect one gearbox to the next. This allows the vehicle to bend and climb over obstacles while keeping as many wheels in contact with the ground as possible.

14 Wheel Drive

All 7 motors are powered by a single cell LiPo battery. In the video after the break it appears the vehicle can steer or that it is remotely controlled, but that is not the case. Once the battery is plugged in it just goes forward. This isn’t the first time one of [rctestflight’s] projects has been featured on Hackaday, check out his Free Falling Quadcopter Experiment.

Continue reading “14 Wheel Drive Vehicle Climbs Over Most Things”

Machining A Yo-Yo With Speed Holes

A while ago, [Gord] received a notice from his daughter’s school looking for silent auction donations for a fundraiser. It’s pretty much a bake sale, only [Gord] gets to build something. He has a pretty nice machine shop, and eventually settled on building a pair of beautiful vacillating vertical pendulums. They’re yo-yos, in case you were wondering what that meant.

Each half is cut out of a 2.5″, with both sides of each half faced off and tapped. From there, eighteen speed holes shave off 22 grams of weight. The sides of the yo-yo are shaved down to a thickness of half an inch, a 14° bevel is put on each face, the edges are chamfered at 30°, and everything is polished up.

Sending a bare metal yo-yo to a raffle is apparently a little uncouth, so [Gord] anodized each half of the yo-yos in a bath of sulfuric acid, then applied dye to the surface. With everything assembled, a fancy glass and metal case was constructed and a certificate of authenticity printed out. It’s a brilliant final touch to a great project, we just wish we knew how the yo-yo performed.

Thanks [Chris] for sending this in.

Who’s Watching the Kids?

It wasn’t long ago that we saw the Echo bloom into existence as a standalone product from its conceptual roots as a smartphone utility. These little black columns have hardly collected their first film of dust on our coffee tables and we’re already seeing similar technology debut on the toy market, which causes me to raise an eye-brow.

There seems to be some appeal towards making toys smarter, with the intent being that they may help a child learn while they play. Fair enough. It was recently announced that a WiFi enabled, “Hello Barbie” doll will be released sometime this Fall. This new doll will not only be capable of responding to a child’s statements and questions by accessing the Internet at large, it will also log the likes and dislikes of its new BFF on a cloud database so that it can reference the information for later conversations. Neat, right? Because it’s totally safe to trust the Internet with information innocently surrendered by your child.

Similarly there is a Kickstarter going on right now for a re-skinned box-o-internet for kids in the shape of a dinosaur. The “GreenDino”, is the first in a new line called, CogniToys, from a company touted by IBM which has its supercomputer, Watson, working as a backbone to answer all of the questions a child might ask. In addition to acting as an informational steward, the GreenDino will also toss out questions, and upon receiving a correct answer, respond with praise.

Advancements in technology are stellar. Though I can see where a child version of myself would love having an infinitely smart robot dinosaur to bombard with questions, in the case of WiFi and cloud connectivity, the novelty doesn’t outweigh the potential hazards the technology is vulnerable to. Like what, you ask?

Whether on Facebook or some other platform, adults accept the unknown risks involved when we put personal information out on the Internet. Say for instance I allow some mega-corporation to store on their cloud that my favorite color is yellow. By doing so, I accept the potential outcome that I will be thrown into a demographic and advertised to… or in ten years be dragged to an internment camp by a corrupt yellow-hating government who subpoenaed information about me from the corporation I consensually surrendered it to.

The fact is that I understand those types of risks… no matter how extreme and silly they might seem. The child playing with the Barbie does not.

All worst case scenarios of personal data leakage and misuse aside, what happens when Barbie starts wanting accessories? Or says to their new BFF something like, “Wouldn’t we have so much more fun if I had a hot pink convertible?”

DIY Hot Wheels Drag Race Timer

[Apachexmd] wanted to do something fun for his three-year-old son’s birthday party. Knowing how cool race cars are, he opted to build his own Hot Wheels drag race timer. He didn’t take the easy way out either. He put both his electronics and 3D printing skills to the test with this project.

The system has two main components. First, there’s the starting gate. The cars all have to leave the gate at the same time for a fair race, so [Apachexmd] needed a way to make this electronically controlled. His solution was to use a servo connected to a hinge. The hinge has four machine screws, one for each car. When the servo is rotated in one direction, the hinge pushes the screws out through holes in the track. This keeps the cars from moving on the downward slope. When the start button is pressed, the screws are pulled back and the cars are free to let gravity take over.

The second component is the finish line. Underneath the track are four laser diodes. These shine upwards through holes drilled into the track. Four phototransistors are mounted up above. These act as sensors to detect when the laser beam is broken by a car. It works similarly to a laser trip wire alarm system. The sensors are aimed downwards and covered in black tape to block out extra light noise.

Also above the track are eight 7-segment displays; two for each car. The system is able to keep track of the order in which the cars cross the finish line. When the race ends, it displays which place each car came in above the corresponding track. The system also keeps track of the winning car’s time in seconds and displays this on the display as well.

The system runs on an Arduino and is built almost exclusively out of custom designed 3D printed components. Since all of the components are designed to fit perfectly, the end result is a very slick race timer. Maybe next [Apachexmd] can add in a radar gun to clock top speed. Check out the video below to see it in action. Continue reading “DIY Hot Wheels Drag Race Timer”